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In the current trend, the network-based system has substantial jobs, and they 
have become the targets of attackers. When an intrusion occurs, the security 
of a computer system is compromised. As a result, we must seek out the best 
methods for ensuring frameworks. A crucial component of the security 
management architecture is the intrusion detection system (IDS). To 
maintain effective network security, the design and implementation of IDS 
remain an important assessment topic. For intrusion detection, the previous 
system created an enhanced relevance vector machine (ERVM) classifier. 
However, intrusion detection is not robust for large-scale intrusion datasets, 
resulting in a high attack rate. The suggested work developed an improved 
deep bagging based convolutional neural network (DBCNN) for intrusion 
detection to address this issue. Preprocessing, feature selection, and 
classification are three processes included in the proposed framework. The 
KDD dataset is preprocessed in this stage using the kalman filter method. 
The feature selection is then carried out using the inertia weight based 
dragonfly method (IWDA). Finally, the DBCNN classifier successfully 
identifies interruption assaults. The KDD dataset is used to test the new 
model. The test results show that the proposed work accomplishes better 
execution contrasted and the current framework as far as accuracy, precision, 
recall and f-measure. 
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1. INTRODUCTION 


Computer networks have been increasingly important in applications. Every day, the number of 
connected devices for this application grows, generating significant amounts of data to send and process. An 
attack/intrusion is a type of unauthorised access that aims to obtain access to systems in order to undermine 
their confidentiality, availability, and integrity. The intrusion detection system is in charge of monitoring 
hostile activities on the system and issuing alerts if such an assault occurs (IDS). IDS provides protection 
against attackers [1]. Network-based and host-based attacks are the two types of IDS. Network-based assaults 
are anomaly-based attacks that are identified through the interconnections of computer systems, and the 
system can communicate with other systems via routers and switches, as well as send attacks through this. 
Host-based assaults may be detected on a single computer system, and they are also simple to defend against. 
These issues are caused by external devices that are connected to the systems. Web-based attacks are also 
possible while connected to the internet, and the attacks are disseminated to other systems via email and 


downloads. 
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Data mining and machine learning techniques are commonly used in this IDS development. The 
most critical features for the entire network are chosen without losing information, according to network 
feature selection. To handle the uneven network traffic, study [2] discusses convolutional neural networks 
(CNN) are a deep learning method based on IDS. In terms of improving IDS performance, existing 
techniques are still insufficient. In this paper, an improved deep learning-based approach has been utilised to 
address difficulties with existing systems in terms of IDS performance and generalisation error reduction. 
The contribution of this paper is as shown in: 

— To manage missing values, the input raw IDS data set is preprocessed with an upgraded kalman filter. 

— After then, the sent data is employed in the feature selection process. The improved inertia weight 
dragonfly optimizer is an evolutionary method described in this suggested work for picking important 
features. The weight and number of iterations will offer the best solution for feature selection. To 
produce the best feature selection, a dragon fly optimizer with inertia weight adjustment is applied. 

— Deep bagging CNN (DBCNN) are used for classification. At contrast to classic CNN, DBCNN uses a 
bagging operation in the output layer to improve classification accuracy. With ensemble classifiers and 
maximum voting, this is introduced in the training process. CNN with bagging can reduce 
generalisation error, training time, and enhance classification performance while reducing noise. 

The recommended feature selection-based classification on IDS data has been tested and compared to 

existing feature selection and classification methods in terms of assessment metrics. 

The paper has been coordinated as; section 2 depicts about the audit of the writing, section 3 
presents developmental based element choice and profound learning grouping draws near, section 4 examines 
about the tested outcomes and section 5 finishes up the paper with future bearings. 


2. LITERATURE REVIEW 

This section discusses the different literature and recent studies on IDS. The NSL-KDD data set is 
used to test several classification algorithms in paper [3]. Using the WEKA tool, this can investigate 
protocols with intruder attacks. To boost classification accuracy, they applied CFS-based dimensionality 
reduction. A paper [4] presented an IDS based on the least square support vector machine (LSSSVM). To 
handle linear and nonlinear correlated features, it used a mutual information-based feature selection method 
[5]. They used the datasets KDD cup 99, NSL-KDD, and Kyoto 2006+. The proposed method outperformed 
existing algorithms in terms of accuracy and computing cost. Filter based feature selection algorithm such as 
information gain, correlation based feature selection, principal component analysis and wrapper based feature 
selection called genetic algorithm, artificial bee colony and particle swarm optimization for network IDS are 
discussed in paper [6]. SVM was employed as a classifier, and the NSL-KDD dataset was used. They came 
to the conclusion that using a wrapper-based feature selection strategy improves classification accuracy. An 
ensemble technique was presented in paper [7] to improve IDS performance. With a tree-based classifier, 
they applied two methods: boosting and bagging. For the evaluation, they employed 35 features and the NSL- 
KDD dataset. They came to the conclusion that bagging using the J48 classifier is more effective [8]-[10]. 


3. PROPOSED METHODOLOGY 

Preprocessing, feature extraction, and classification are three aspects of the proposed method. 
Figure 1 depicts a high-level overview of the technique. The network data set is initially partitioned into three 
datasets, such as training and testing, in a 6:4 ratios. Preprocessing is important in all classification algorithm 
techniques since it improves accuracy. This preprocessing technique removes the irrelevant and missing data 
from the original data. In this proposed work, first, Kalman filter (KF) based pre-processing is done to handle 
the missing values and data that are out of range for further processing. This preprocessed data is then given 
as input to the feature selection phase. The irrelevant features in the dataset will affect the performance of the 
network traffic classification in terms of accuracy and make the system as slow. Second, IDS based on 
optimal feature selection using the evolutionary method called improved inertia weight based dragon fly 
optimizer has been proposed. This is used to remove the irrelevant features and select the relevant features 
for further processing. Until the stopping condition met, the relevant features are selected using the proposed 
approach. Selected features are then trained and classified using the deep learning algorithm called DBCNN. 
These suggested IW-DFO based DBCNN classification approaches were tested against the intrusion 
detection dataset to demonstrate the efficacy of the presented work in terms of performance metrics. 
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Figure 1. Overview of proposed IDS approach 


3.1. Feature selection using proposed improved inertia weight based dragon fly optimizer (IW-DFO) 
The Department of Fisheries and Oceans is replicating dragonfly behaviour for the purpose of 
migration or hunting. Swarming can take two forms: static and dynamic. Tiny groups of dragonflies hunt 
other swarms in a small region with local movement of dramatic shifts in a motionless swarm. A big number 
of dragonflies fly in a single direction over a long distance together in a dynamic swarm [11]. The most 
significant elements of swarm intelligence techniques are the exploration and utilisation of this static and 
dynamic activity. The five weights must be modified to maximise the exploration and exploitation process. 
Separation, alignment, cohesion, food attraction, and DFO's opponent distraction have all been 
mathematically stated: 
a. Separation: it is the individual avoidance from other neighborhood to separate themselves from other 
agents. It is calculated as in (1) from [12] 


8, = — Dp X -Xj (1) 


where, X=current position, X;=position of the j neighbor, N=number of neighbors of the dragonfly, 

S-separation motion of the ith individual. 

b. Alignment: it is the matching of velocity of the individual to the neighbor individual. It is the agent 
setting of velocity in terms of velocity vector of the neighbor dragonflies. It is calculated as in the (2) 


N 
ne Yin Vj 


Aj x 


(2) 


Where, Aj=alignment motion of the i" individual and Vj=velocity of the j neighborhood 
c. Cohesion: it is the measurement of the individual towards the center of the neighborhood. It is 
represented as in (3) 


N 
yj Xj 


C; = N 


y (3) 


where, C;=cohesion of the i™ individual, N=size of neighborhood. 
d. Attraction towards food: the dragonfly movement towards the attraction of food is represented in (4). 


F, =X*+*-X (4) 


where F,=attraction of food of ith individual, X*=position of the source of food. 
e. Distraction from enemies: dragonflies stay away from enemies which is represented in (5) 


E; =X +X (5) 
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where E;=distraction motion of ith individual enemy, X~=position of enemy. The position of the individual 
dragonfly has been updated by considering two factors such as step factor AX and position vector X. The step 
vector is same as in the velocity vector of the PSO algorithm [13] which is defined as [14] in the (6). 


AX p41 = (S; + Aj + C; + F; + E;) + wx, (6) 


where, w=inertia weight and t=counter for the iteration. The appropriate selection of this inertia weight with 
least number of iterations produce the optimal solution. In this proposed work, the inertia weight of the step 
vector has been improved as in (7) 

OC = et (7) 

max 

where, Wmax ANd Wmin=starting and ending values of the dragonfly, t,,g,=maximum iteration and t- number 
of iterations. The weight and the maximum number of iterations are inversely proportional. Increasing the 
number of iterations, the weight value gets decreased leas to global search ability as strong. Once the step 
vector calculation over, the position vector has been updated as in (8). 


Xt+1 = Xt + AXta1 (8) 


Pseudo code of IIW-DFO: 
Input: Dragonfly population and step vector X i,i=(1,2,...n) 
The first step is to iterate as many times as possible (t max) 


Step 2: Dragonfly objective values are determined. 

Step 3: Update the food source and enemy. 

Step 4: Using (1), determine five weight factors such as S, A, C, F, and E. (5) 
Step 5: Update the radius of your neighbours 

Step 6: if the dragon fly has a neighbour 

Step 7: Using the velocity vector [15], update it (6) 

Step 8: Using the inertia weight, update the inertia weight (7) 

Step 9: Using the position vector, update it (8) 

Step 10: if not, 

Step 11: levy flight [16] is used to update the position vector. 

Step 12: if everything else fails, call it a day. 

Step 13: The dragon fly's new position is modified based on the changeable boundaries. 
Step 14: come to an end 

Output: return selected features set 


The enhanced inertia weight is applied to the enhanced inertia weight is applied to the five weight 
vectors, velocity, and position vectors until the maximum iteration is reached. If the dragons fly has any 
neighbours, the position is updated as well. For intruder detection [17]-[19] the optimised features are now 
fed into a deep learning-based classification technique called DBCNN. 


3.2. Classification using proposed deep bagging convolutional neural network 

CNN is differentiated with traditional neural network in terms of the convolution layer and pooling 
layer which is also responsible for feature extraction. Deep CNN can take input as image or audio or any 
other format. Those input data are preprocessed to get better result. The convolution layer convolutes the 
inputted data to select the features objects and transmit the results to sub layer. The network training will 
train the whole network parameters for this convolution. In this layer, the activation function has been 
applied for nonlinear activation. Pooling layer is used for sub sampling to reduce the data that are generated 
by the convolution layer. Full connection layer is for classification which is the global operation. Each node 
in the full connection layer is connected to all the node of previous layers. The output layer is responsible for 
to produce the classification result with softmax function. Classification performance of the deep CNN has 
been improved with the bagging operation that are replaced the output layer of the traditional CNN. The 
results from the convolution and pooling layer are given as input to the bagging ensemble classifier. 
Classification output is based on the maximum voting of the ensemble. 

The bagging method can introduce the bootstrap sampling into the training process of the network. 
This will reduce the generalization error, training time, reduced noise and improve the classification 
accuracy. Structure of the improved deep bagging CNN is shown in Figure 2. Let L be the number of 
network layers. The size of the convolution kernel is k. the kernel matrix dimension is declared as D. s is the 
filling size and P represents the convolution kernel moving. Steps involved in the DBCNN are as shown in: 
Input: Data set D, number of features n 
Step 1: Initialize parameters: Initialize the weight w, bias b and the maximum number iteration T and the 
threshold for the iteration €. 
Step 2: Training phase: It consists of forward, backward propagation, and weight and bias updates. 
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Step 3: Forward propagation: Training data set are given as input and the output is calculated. 
For cl=2 to L-1 
— Ifclis the convolution layer, then the missing data after filling (a°') is represented in (9) 
a = ReLU(z) = ReLU (a! x w® + b“) (9) 
—  Ifclis the pool layer then, 
a" = pool (a®t) (10) 
—  Ifclis full connection layer then, 
at = o(z") = a(w"at-1 + b°) (11) 


End for 
— The output layer of L is represented in (12) 


a! = softmax(z") = softmax(w“a‘1 + b”) (12) 


Random 
subset 2 


| Output | 


Figure 2. Structure of improved deep bagging CNN (IDBCNN) 


Step 4: Backward propagation: This progression used to ascertain the blunder between real yield and relating 
yield. For cl=2 to L-1 


If cl is the fully connection layer then,6° = (wt1)T, 6t O o(zt® (13) 
If cl is the convolution layer then, 5° = 5¢* x rot 180 w°! © a(z*") (14) 
If cl is pool layer then, a! = upsample(5"**1) © o(z**) (15) 


An improved deep bagging convolutional neural network classifier for efficient ... (R. Mathiyalagan) 


410 o ISSN: 2302-9285 


End for 

Step 5: weight and bias update: to minimize the error, the weight and bias matrix are updated. 
For cl=2 to L-1 

—  Ifclis the fully connection layer then, 


wet = wt — a ym, sbel(qiel-1yT (16) 

b! = p —aym, sie 7) 
—  Ifclis the convolution layer then, 

wt = wt — ayn, siel x (abt) (18) 

be = bY — a Xita Duo uv (19) 


End for 

Step 6: termination condition checking:if (| la 
Else go to step 1. 

Step 7: Bagging: N is the number of base classifiers and the classification label is defined as Y={-1. +1}. The 
bagging method is declared in (20), 


‘+1 _ at|| < or t <T then loop ends 


Y = A(x) = sign © i hi(x) (20) 


Step 8: Output: return Y and the relation coefficient matrix w and b. 

Hence, the evolutionary based featuer selection algorihtm called inertia dragonfly optimizer selects 
the optimal number of relevant features. Deep learning based proposed classfiicaiton with bagging concept 
will classify the IDS daa with high accuracy with low noise. 


4. RESULTS AND DISCUSSION 

This section discusses the outcomes of the experiments and the proposed feature selection and 
classification on IDS. On the NSL-KDD dataset, binary classification was employed, and it was implemented 
using the keras python deep learning framework. 


4.1. Evaluation using performance metrics 

The proposed IIWDFO-IDBCNN-IDS system is compared to existing systems in order to evaluate 
performance utilising performance metrics such as accuracy, FPR, FNR, sensitivity/TPR, specificity/TNR, 
and recall/attack detection rate (ADR) [20]. The formulae for the evaluation metrics are as: 


TP+TN 


ACC = ————_ (21) 
TP+TN+FP+FN 
FPR = — (22) 
FP+TN 
FNR = —— (23) 
FN+TP 
sn = (24) 
TP+FN 
SP = (26) 
TN+FP 
ADR = — (27) 
TP+FN 


4.2. Performance evaluation based on NSL feature selection approaches 

Table 1 shows the Depending on the original and selected input qualities, IDS performance varies. 
There are representations of the original 41 features, normalised 41 features, and normalised with feature 
selection using IIWDFO selected 7 features. Table 1 shows how vital it is to use a two-step normalisation 
approach to eliminate network traffic data. The feature selection procedure also addresses the issue of 
overfitting and improves the IDS' overall performance in order to improve classification accuracy. Reduce 
the rate of error and the time it takes to identify it, as well as the computing complexity. 
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Table 1. Performance evaluation of the proposed feature selection algorithm 


Input features 
Original features Normalized features Selected features by IW-DFO 


Evaluation metrics 


No of selected features 41 41 7 

Accuracy 92.43 96.37 98.91 
FPR 0.016 0.015 0.011 
FNR 0.178 0.051 0.018 
ADR (%) 89.31 95.31 98.03 
Training time (s) 231.39 13.023 3.92 
Testing time (s) 272.1 32.31 9.03 


The performance of the proposed work's feature selection is compared to those of existing FS on 
IDS, such as standard DFO [21], FMIFS [22], FLCFS [23], and IGDFOPSOCCNN [3]. Table 2 displays the 
experimental outcomes. 


Table 2. Performance evaluation of proposed IITW-DFO feature selection with other IDS FS approaches 
Feature selection approaches 


Metriés DFO _FMIFS _FLCFS _IGDFOPSOCCNN _ Proposed IIWDFO 
Selected features 23 18 22 16 7 
ACC 92.1 889 91.23 92.81 98.72 
SN 91.92 87.02 90.82 91.02 98.88 
SP 87.92 90.82 92.72 88.06 98.02 
ADR 93.82 88.61 91.02 90.52 98.34 


Table 2 illustrates that, when compared to other existing contemporary techniques, the proposed 
IIW-DFO FS achieves high accuracy with low complexity analysis, meaning that these selected features 
would improve classification accuracy and protect the computer network from intruders. The graphical 
evaluation is depicted in Figure 3. The graphical figure also shows that the proposed FS strategy outperforms 
existing techniques in terms of accuracy, sensitivity, specificity, and attack detection rate. 


PROPOSED VS EXISTING IDS-FS 


100 
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Selected ACC SN 
Features 


Metrics 


{DFO #)FMIFS &IFLCFS OSMOTE-ENN W Proposed IIW-DFO 


Figure 3. Existing with proposed IT'W-DFO 


4.4. Performance evaluation of proposed IIWDFO-IBCDNN IDS with existing IDS systems 

We compare our proposed convolutional deep neural network based IDS to current IDS systems 
such as DMNB [24], DBN-SVM [25], PSOM [1], and IGDFOPSOCCNN [3] to prove the deep neural 
networkbased IDS systems. The evaluation's results are shown in Table 3. 


Table 3. Performance evaluation of various existing vs proposed IDS systems 


IDS systems No of Selected Features Accuracy (%) _ FPR 
DMNB 41 96.01 1.76 
DBN-SVM 41 91.53 2.03 
PSOM 10 94.82 3.12 
IGDFOPSOCCNN 6 94.02 0.52 
Proposed IIWDFO-IDBCNN 7 98.71 0.12 
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The suggested improved inertia weight dragon fly optimizer with improved DBCNN based IDS has 
higher accuracy and lower FPR rate than other current IDS techniques, including our earlier work, based on 
the experimented results. The suggested system detects intruders with an accuracy of 98.71 percent and a 
false positive rate of 0.12. Because of the optimization procedure, the IIWDFO-IBCDNN IDS achieves such 
great accuracy. Figure 4 exhibit a graphical representation of these data for a better understanding. 
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Figure 4. Accuracy comparison of various IDS 


As a result, the various IDS process tried results reveal that our proposed IW-DFO-IDBCDNN has 
high classification accuracy, low error, and low computing complexity. Even while our previous work is 
better at detecting intruders, this work using the optimization strategy will increase classification accuracy as 
well. The IRWDFO-based IDBCDNN beats other existing algorithms in identifying intruders with high 
accuracy and low error in terms of efficiency and accurate categorization. 


5. CONCLUSION 

This research presents a feature selection method based on the inertia weight dragonfly optimizer 
and an upgraded DBCNN for IDS. Due to the enormous number of features and amount of data in the data 
set, an enhanced proposed classification technology based on evolutionary and deep learning algorithms is 
provided to increase classification accuracy and forecast network intruders. The easiest way to locate relevant 
characteristics is to use an optimization-based feature selection method. The accuracy and stability of the 
system will be increased by a deep convolutional network with bagging. The NSL KDD dataset is used to 
develop the suggested system. The algorithm's efficiency is demonstrated by a comparison of known 
contemporary algorithms in terms of feature selection and classification. The results reveal that the suggested 
evolutionary-based deep learning method outperforms in terms of accuracy (99.11%) and false positive rate 
(0.8). In the future, the proposed technique will be tested on a small number of datasets with the goal of 
improving the attack detection rate in the NSL KDD dataset. As a result, the proposed IDS system will 
enhance classification accuracy while reducing generalisation error, training time, and noise. 
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